A Delegated Authorization Use Case
This use case has come up in previous articles and posts, and I’d like to take a deeper look at what’s possible today to support such scenarios. Let’s start with describing the use case, then examining how it could be implemented using existing technologies, and finally outlining its limitations.
The Use Case
“As a busy working mom, I want to delegate authority to my daughter to stop by Costco after school and pick up groceries. My daughter doesn’t have her own Costco card, so she needs to use my membership and payment method. Costco must be able to verify that the person using the credential is indeed my daughter and that she’s been authorized by the account holder to make purchases up to a specified spending limit (e.g., $400).”
Breaking Down the Use Case
What’s required to make this use case work?
User Journeys for Alice and Eve
Let’s assume the Costco mobile app supports the creation of a Digital Credential (more formally, a Verifiable Credential or VC) containing:
Alice opens the Costco app, selects an option to delegate her membership, and sets a $400 spending limit. She uploads a recent photo of Eve to help store personnel verify her identity. The app generates the credential and displays a QR code, which Eve scans with her mobile wallet to receive the credential.
At the store, Eve presents her credential at the entrance. The Costco scanner reads the credential, displays Eve’s photo, and a staff member confirms her identity. She’s allowed in.
At checkout, Eve presents the same credential again. Costco verifies her identity and the spending limit. If all checks out, the transaction is processed using the payment method associated with Alice’s Costco account. (Note: Costco already supports mobile payments in-app today.)
What Standards Make This Technically Possible?
Several emerging identity standards support this type of delegated access:
These standards can be used to transfer credentials securely and verify them without exposing unnecessary data. Additionally, identity verification technologies (e.g., biometric matching or photo confirmation) could enhance trust, even without direct photo embedding.
Implications
This use case is viable because the issuer and the verifier are the same entity—Costco. Since Costco both issues and verifies the credential, it doesn’t need to rely on an external party’s trustworthiness. It can validate whether the credential was issued by its own systems and enforce strict rules such as expiration or usage limits.
For example, Costco might:
However, if the issuer and verifier were different entities (e.g., issuing a credential from a school to be used at a third-party store), the trust model becomes more complex. Liability, interoperability, and governance all become critical concerns.
Final Thoughts
As we move toward a world of digital wallets and verifiable credentials, scenarios where the issuer and verifier are the same legal entity will be the easiest to implement. These reduce complexity, legal liability, and trust barriers significantly.
Cross-domain use cases—where issuer and verifier are different—require robust governance frameworks, like those discussed by Heather Flanagan and others in the identity community. Without such frameworks, adoption of broader delegated access scenarios will remain limited due to unresolved risk and trust concerns.
Founder, HUME-IT | Trusted Advisor and Enterprise Security Architect | VMware, AD, Azure, AWS & Entra ID
5moHaving the same organization issue and verify the credential makes it easier to enforce rules and reduce risk. But I’m curious how delegated credentials would work when different entities are involved, like a bank issuing one and a retailer verifying it. Definitely a thought-provoking example.
To add to the mix, there are a few ways to protect Eve's privacy: (1) transform Facial image into a 'biometric token' for 1:1 verification at the time of pick-up; (2) offer Eve a choice of enrolling with her Palm; (3) offer Costco members to self-enroll a friend, neighbor, or a caretaker (using tokenized biometrics in a QR code) to pick up prescriptions or other items when unable to travel. Perhaps augment with phone number of the 'delegated to' person, if needed.
Looking forward to sessions and discussions George Fletcher
CSO | CIO | CPO | Digital Identity | Cybersecurity | CISO Advisor | +$4B Category Creator | Author | Keynote Speaker | Board Member | Investor | M&A | Co-Creator of Machine Identity Management (NHI)
5moSee you there George Fletcher !
I like how you presented this use case. From a privacy standpoint, I do not love that the store could ask for a portrait of a minor but I understand the need to enhance trust - we could store it in the credential (that is being done for the mDLs so it doesn't have to be stored by the store) or we could also think that the identity evidence is decoupled from the credential issued by the store for delegating the purchase right and the kid would have to provide their own identity evidence if asked by the store (could be either physical or digital) to see it matches what is in the other credential. If we use verifiable credentials for everything, Alice could present multiple credentials that meet the requirements for the presentation (e.g. the one from costco saying delegate purchase right and the one from the digital identity provider like a school or a state id). I would be more for a paper based credential presented as a QR code (for example) for this type of scenario so you don't need the kid to have a mobile device for this flow to work.